In the world of gaming, customization is king. Players love tweaking their favourite games to make them even more exciting. But while mods and customizations can enhance your gaming experience, they can also hide dangerous threats. A new version of this malware (identified as d9d394cc2a743c0147f7c536cbb11d6ea070f2618a12e7cc0b15816307808b8a) was recently found concealed within a WinRAR self-extracting archive, cunningly masquerading as a Windows screensaver.
Enter zEus, a sneaky malware that is making its way into Minecraft source packs.
Let's Understand In Detail How It Works
Unsuspecting players download what seems like a harmless source pack, only to find themselves unknowingly installing zEus onto their systems. Once activated, the malware gets to work, stealing sensitive data and sending it off to a Discord webhook, where the perpetrators eagerly await their ill-gotten gains. But the trickery doesn't stop there.
The self-extract file not only runs the malicious software but also opens an innocuous-looking image file, featuring the word "zEus." This simple image serves as a distraction while the malware does its dirty work in the background. It's a cautionary tale for gamers everywhere: be vigilant when downloading mods and source packs, especially from unverified sources. Stay safe by sticking to reputable platforms and avoiding suspicious links and downloads. After all, in the world of gaming, it is not just high scores you need to watch out for—it is also stealthy malware like zEus.
When zEus malware is executed, it first checks if it's being analyzed. If not, it collects sensitive data and deploys script files for flexibility. It creates folders in C:\ProgramData to store stolen data and malicious scripts. To avoid detection, it compares computer names and running processes against blacklists. The malware steals various information, storing each piece in text files within corresponding folders.
It grabs IP details using online tools and collects hardware info using command-line utilities and PowerShell. It also targets browsers like Chrome and Firefox, copying login data, cookies, history, and bookmarks. Additionally, zEus steals login data from software like Steam and Discord and searches for Discord backup codes. It copies .ldb files from Discord's Local Storage, extracting account details. It also gathers data from game-related folders to understand the victim's interests.
After collecting data, it compresses it into a zip file and deletes the original folders. The malware sends the zip file and system information like execution date, username, processor, and antivirus software. It also checks for cryptocurrency wallets and searches for files with keywords related to login mechanisms and sensitive data.